5 stories
The demos show a malicious PDF opened through iMessage or Signal ending in code execution, followed by an app that roots the phone. Calif says most of the bugs behind them already went to Apple.
The thread split over a different question: is it responsible to show a working takeover before a patch exists, or is the publicity what gets people to update?
The top HN threads: facts from the discussions, both sides, insider voices. Email, Telegram, or RSS.
Landau calls it an "incoherent cryptosystem": the server that wants to read your messages is the same server shipping the JavaScript that's supposed to stop it — and it can push different code to one IP at any moment. He extends the charge to Signal, WhatsApp and iMessage.
The pushback is credentialed on both sides. One security researcher says you can build Signal from source yourself, so it doesn't apply — then, in the same breath, points out iMessage isn't really end-to-end anyway because iCloud Backup is on by default.
Heise reports the Council revived an expired rule letting messaging providers voluntarily scan for known child-abuse imagery, pushed as new legislation on an urgent second-reading track right before recess — where blocking needs a near-impossible absolute majority.
A commenter untangles it: the far more dangerous Chat Control 2.0, with mandatory scanning that would weaken end-to-end encryption, is not what's being voted here — and protest has arguably pushed 2.0 off the table for good.
Patrick Breyer's alert describes two moves in one weekend: the Council reviving the lapsed Chat Control 1.0 on Friday, and a final closed-door trilogue on the permanent Chat Control 2.0 that Monday. The mechanism is the point. A bill killed in open Parliament gets retried in a room where 'voluntary' scanning can be recast as an enforceable risk-mitigation duty.
A commenter who works inside legislative committees translated the venue: a trilogue is the EU analog of House and Senate members negotiating in private, with redacted documents and no public floor debate, so the bill never gets debated and never gets rejected.
The UK is moving to mandate on-device content scanning and age verification, framed as child protection. Signal answered overnight with a blunt statement: client-side scanning breaks the encryption it sits on top of, and a scanner that 'phones home' is mass surveillance no matter what it claims to look for.
The thread mostly cheers, but a Signal-built-this skeptic pushes back: on-device checks are no more surveillance than Signal's own private contact discovery, and the slippery-slope cuts both ways.
